
Prof Bashar Nuseibeh
Professor Of Computing
School of Computing & Communications
Biography
Professional biography
I am a Professor of Computing at The Open University (Director of Research, 2002-2008). Previously, I was a Professor of Software Engineering and Chief Scientist of Lero – the Irish Software Research Centre, based at the University of Limerick. I was also an academic member of staff (Reader) in the Department of Computing at Imperial College London and Head of its Software Engineering Laboratory (1990-2001). I continued my association with Imperial College as a Visiting Professor between 2005-2015. I am currently an Honorary Professor at University College London (affiliated with UCLIC and previously SSE) and a Visiting Professor at the National Institute of Informatics, Japan, and University College Dublin, Ireand.
I am the recipient of a Royal Society-Wolfson Merit Award (2013-2018) and a European Research Council (ERC) Advanced Grant on Adaptive Security and Privacy (2012-2018). I held a Senior Research Fellowship from The Royal Academy of Engineering and The Leverhulme Trust (2005-2007), and served as Editor-in-Chief of the Automated Software Engineering Journal (1995-2008), IEEE Transactions on Software Engineering (2010- 2013), and ACM Transactions on Autonomous and Adaptive Systems (2017-2021). I am currently an Asociate Editor of IEEE Security & Privacy Magazine, ACM Transactions o Sowfatere Engineering and Methodology, and ACM Books.
I am a Fellow of the Royal Academy of Engineering(FREng), the Association of Computing Machinary (FACM), the British Computer Society (FBCS), the Irish Computer Society (FICS), the Institution of Engineering & Technology (FIET), and a Member of Academia Europaea (MAE) and the Royal Irish Academy (MRIA).
I someties maintan a personal website, but a more up to date publication list can be found at Google Scholar or DBLP.
Research interests
My research interests are broadly in software engineering, particularly in the areas of requirements engineering and design, with a special interest in applications in security, privacy and digital forensics.
My technical research is currently focused on engineering adaptive software that underpins many modern mobile and ubiquitous computing technologies, and my research methods are often empircal and multidisciplinary, a particular aim of which is to understand the interplay between the engineering of software-intensive systrems and human behavior. Broadly speaking my research aims to help engineer systems that promote pro-social behavior and mitigate agaist anti-social behaviour.
Teaching interests
I have a long standing interest in software engineering education, with experience of face to face teaching at undersgraduate and postgraduate levels at Imperial College London, of postgraduate distance education at The Open University, and professional training and tutorials at international conferences and workshops.
I also have a few publications on software engineering education, focusing on course and curriculum development.
I recently co-editred an open access textbook on an Introduction to Digitial Humanism.
Impact and engagement
External collaborations
I have strong collaborative relationships with organisations (academic and industrial) in the UK and beyond. These include collaborative projects with Imperial Colllege London, University College London and Lancaster University in the UK, Qatar University in Qatar, National Institute of Informatics in Japan, and Lero in Ireland.
International links
I have strong research links with Lero - The Irish Software Research Centre and the National Institite of Informatics (NII). These include joint projects/funding, joint publications, and researcher exchanges.
Projects
Software Engineering for Usable Mobile Privacy Management (XC-11-007-BN)
SEIF 2011 Prize for "Software Engineering for Usable Mobile Privacy Management"
SAUSE: Secure, Adaptive, Usable Software Engineering
In the last decade, the role of software engineering has changed rapidly and radically. Globalisation and mobility of people and services, pervasive computing, and ubiquitous connectivity through the Internet have disrupted traditional software engineering boundaries and practices. People and services are no longer bound by physical locations. Computational devices are no longer bound to the devices that host them. Communication, in its broadest sense, is no longer bounded in time or place. The Software Engineering & Design (SEAD) group at the Open University (OU) is leading software engineering research in this new reality that requires a paradigm shift in the way software is developed and used. This platform grant will grow and sustain strategic, multi-disciplinary, crosscutting research activities that underpin the advances in software engineering required to build the pervasive and ubiquitous computing systems that will be tightly woven into the fabric of a complex and changing socio-technical world. In addition to sustaining and growing the SEAD group at the OU and supporting its continued collaboration with the Social Psychology research group at the University of Exeter, the SAUSE platform will also enable the group to have lasting impact across several application domains such as healthcare, aviation, policing, and sustainability. The grant will allow the team to enhance the existing partner networks in these areas and to develop impact pathways for their research, going beyond the scope and lifetime of individual research projects.
REsilient Autonomous SOcio-cyber-physical ageNts
REASON will develop a comprehensive toolbox of general principles, mathematically based notations and models, reasoning methods, and systematic approaches enabling autonomous systems to operate with unprecedented levels of resilience. Analogous to the adaptive toolbox widely hypothesised to underpin human decision-making under uncertainty,17 our REASONing toolbox will allow autonomous systems to decide and perform resilience-enhancing actions safely, securely and observant of relevant social, legal, ethical, empathy and cultural rules and norms. Using the REASONinig toolbox, autonomous systems will proactively quantify and reduce uncertainty, predict and preempt disruptions, seek assistance from and co-operate with humans and peer autonomous systems, and provide assurances to instil stakeholder trust. The REASON vision will be delivered by a team of Computer Scientists ( CS ), Engineers ( Eng ), sychologists ( Psy ), Philosophers ( Phil ), Lawyers ( Law ), and Mathematicians (Math) with an extensive track record of leading large research programmes and of delivering research in all areas of the project.
Citizen Forensics
The Citizen Forensics project reframes key challenges that underlie modern policing in a socio-technical world; a world instrumented with mobile and ubiquitous computing technologies, in which many citizens and communities live, work and play, but which must also manage threats to their wellbeing and their rights. The project aims to support a new engagement between authorities (such as the police) and communities of citizens in order to better investigate (and in the long term reduce) potential or actual threats to citizen security, safety, and privacy. This includes both empowering the police by opening up new ways of citizens providing data in ways that protect privacy and anonymity, and empowering citizens by using these new technologies to also hold the police to account. We will be harnessing many of the so-called Internet of Things, Smart City and Smart Home technologies to encourage and allow citizens to help the police collect and analyse disparate data to improve public safety at both local and ultimately national levels. This multidisciplinary investigation draws upon expertise in computing, policing, psychology and organisational theory. For more information, see https://www.citizenforensics.org/
Why Johnny doesn’t write secure software? Secure Software Development by the Masses
Developing software is no longer the domain of the select few with deep technical skills, training and knowledge. Mobile and web app development and easy to program hardware devices, such as Arduino and Raspberry Pi, have resulted in a wide range of people from diverse backgrounds developing software. Such software can be, and is, used by a potentially global user base. But what are the security implications of such software development by ‘the masses’. Are we moving toward a ‘wild west’ in which a diversity of skills and motives in those developing software will affect its security? This diversity of developers is here to stay and is at the heart of a range of innovations in the digital economy. However, little is currently understood about the security behaviours and decision-making processes of the masses – Johnny – engaging in software development. Without such foundational understanding, we cannot hope to leverage a hitherto untapped resource, Johnny, in developing resilient software that is used by millions around the world. From this foundation, we can consider the implications of their assumptions and design choices and provide new tools and techniques to support them. Such foundational research and advances are the focus of this proposal.
STRETCH: Socio-Technical Resilience for Enhancing Targeted Community Healthcare
The aim of this project will be to build a dynamic and resilient socio-technical system that sustains care for people with chronic illnesses in old age. Its principle novelty will be the integration of human and technical resources into a single system that will have resilient care at its heart. Resilience will mean both social resilience and technical resilience. To deliver social resilience we will explore how technology can help to harness existing social support as well as building wider social capital around older people. To deliver technical resilience we will design systems that integrate existing technological capacity in novel configurations as well as integrating new sensing / Internet of Things capability. However, the key innovation will be that the integrated socio-technical system will allow for the interchange between human assets and technological assets in the delivery of a resilient care architecture for older people. The system will not seek to replace human resource with a technology derived alternative, but to harness the capacities of all elements of the system in a way that serves the needs of the older person. Sometimes the system will respond to need through mobilising human resources, at other times the same need could be met through technological capability. In that sense, the system will have the needs of the older person at its core.
Drone Identity
This EngageKTN project is investigating forensic-readiness requirements of unmanned aerial systems, to help identify causes of safety and security related air traffic incidents. Unmanned aerial vehicles (or drones) are increasingly creating challenges for managing the safety of aircraft that share the airspace with them. The collection and use of forensic data associated with drones and surrounding physical contexts is key to effective incident investigations. The research is focusing on the architecture and concept of operations for European unmanned traffic management, and the ability to preserve such vital information as evidence for forensic investigations. The team of the project include Dr. Yijun Yu (PI), Mr. Danny Barthaud (Research Software Engineer), and Prof. Bashar Nuseibeh, Prof. Blaine Price, Prof. Andrea Zisman, Prof. Arosha Bandara at The Open University, and Dr. Anthony P. Rushton, Dr. David L. Bush, and Dr. George S. Koudis at NATS. The project URL is at https://droneidentity.eu.
Scenarios@runtime for Self-adaptive Systems
Software engineers increasingly treat software systems development as an evolutionary process, in which the software is continuously modified throughout its lifetime in response to changes in customer requirements and needs. Modifications are usually carried out by halting system execution, updating source code or structure, and then re-executing the software. However, a new paradigm of engineering adaptive software is emerging. In this paradigm, models are created during systems development, but these then continue to evolve at both production time and at execution time (becoming so-called "runtime models"). Runtime models differ from the models that are developed during software production, in that they need to accommodate events that occur while the system is running and interacting with its operating environment, potentially changing the decision-making behaviour of the systems that they underpin.
Adaptive Security And Privacy (XC-12-029-BN)
Salary enhancment to retain staff at UK insitutions.
Publications
Book
Engineering Adaptive Software Systems (2019)
Software Requirements and Design: The Work of Michael Jackson (2010)
Book Chapter
Humans in the Loop: People at the Heart of Systems Development (2024)
Responsible Software Engineering: Requirements and Goals (2024)
Requirements Engineering (2019)
Assessing Security and Privacy Behavioural Risks for Self-Protection Systems (2019)
Design and Engineering of Adaptive Software Systems (2019)
Parallel Adaptation of Multiple Service Composition Instances (2019)
Data Privacy: Users’ Thoughts on Quantified Self Personal Data (2018)
Aspect interactions: a requirements engineering perspective (2013)
Security patterns: comparing modeling approaches (2010)
Arguing satisfaction of security requirements (2008)
Arguing satisfaction of security requirements (2006)
Hypermedia support for argumentation-based rationale: 15 years on from gIBIS and QOC (2006)
The Learning Grid and E-Assessment using Latent Semantic Analysis (2005)
Problem frames: a case for coordination (2004)
Using abuse frames to bound the scope of security problems (2004)
Journal Article
Security requirements and secure software design (2025)
Engineering within boundaries when software has none (2025)
Reflections on using the story completion method in designing tangible user interfaces (2024)
Infrastructural Justice for Responsible Software Engineering (2024)
The Rocky Road to Sustainable Security (2024)
The IDEA of Us: An Identity-Aware Architecture for Autonomous Systems (2024)
On Specifying for Trustworthiness (2024)
Security Responses in Software Development (2023)
Topology-Aware Adaptive Inspection for Fraud in I4.0 Supply Chains (2023)
Forensic Readiness of Industrial Control Systems Under Stealthy Attacks (2023)
Digital Intervention in Loneliness in Older Adults: Qualitative Analysis of User Studies (2023)
Adaptive Observability for Forensic-Ready Microservice Systems (2023)
Significant Features for Human Activity Recognition Using Tri-Axial Accelerometers (2022)
The case for Zero Trust Digital Forensics (2022)
The Case for Adaptive Security Interventions (2022)
The Case for Animal Privacy in the Design of Technologically Supported Environments (2022)
Bumps in the Code: Error Handling during Software Development (2021)
Digital detectives: websleuthing reduces eyewitness identification accuracy in police lineups (2021)
Privacy Care: A Tangible Interaction Framework for Privacy Management (2021)
Building trust in digital policing: a scoping review of community policing apps (2021)
Designing Privacy-aware Internet of Things Applications (2020)
Taking the Middle Path: Learning about Security Through Online Social Interaction (2020)
On the Automated Management of Security Incidents in Smart Space (2019)
Text Filtering and Ranking for Security Bug Report Prediction (2019)
LiveBox: A Self-Adaptive Forensic-Ready Service for Drones (2019)
Assessing the Privacy of mHealth Apps for Self-Tracking: Heuristic Evaluation Approach (2018)
On the Interplay Between Cyber and Physical Spaces for Adaptive Security (2018)
CrowdService: Optimizing Mobile Crowdsourcing and Service Composition (2018)
Topology-Aware Access Control of Smart Spaces (2017)
Adaptive evidence collection in the cloud using attack scenarios (2016)
Protecting Privacy in the Cloud: Current Practices, Future Directions (2016)
Automated analysis of security requirements through risk-based argumentation (2015)
“Why can’t I do that?”: tracing adaptive security decisions (2015)
Specifying software features for composition: a tool-supported approach (2013)
Analysing monitoring and switching problems for adaptive systems (2012)
A hybrid model for automatic emotion recognition in suicide notes (2012)
Analysing anaphoric ambiguity in natural language requirements (2011)
Requirements-driven design of service-oriented interactions (2010)
Security requirements engineering for evolving software systems: a survey (2010)
Securing the skies: In requirements we trust (2009)
Specifying features of an evolving software system (2009)
Placing computer security at the heart of learning (2008)
Security Requirements Engineering: A Framework for Representation and Analysis (2008)
Using trust assumptions with security requirements (2006)
Learning software engineering at a distance (2006)
Editorial: Relating software requirements and architectures (2005)
Keeping ubiquitous computing to yourself: a practical model for user control of privacy (2005)
Modelling access policies using roles in requirements engineering (2003)
Lightweight Validation of Natural Language Requirements (2002)
Presentation / Conference
Meta-Modelling Kindness (2024)
How Do People Use a Public Gratitude Platform in the Wild? (2024)
Requirements for Designing Kind Spaces (2023)
Towards a Socio-Technical Understanding of Police-Citizen Interactions (2023)
Meet your Maker: A Social Identity Analysis of Robotics Software Engineering (2023)
Socio-Technical Resilience for Community Healthcare (2023)
Feel It, Code It: Emotional Goal Modelling for Gender-Inclusive Design (2023)
A Card-based Ideation Toolkit to Generate Designs for Tangible Privacy Management Tools (2023)
Security Thinking in Online Freelance Software Development (2023)
Values@Runtime: An Adaptive Framework for Operationalising Values (2023)
Accounting for socio-technical resilience in software engineering (2023)
Influences of developers' perspectives on their engagement with security in code (2022)
What Do You Want From Me? Adapting Systems to the Uncertainty of Human Preferences (2022)
Six Software Engineering Principles for Smarter Cyber-Physical Systems (2021)
On Adaptive Fairness in Software Systems (2021)
Engineering Adaptive Authentication (2021)
Towards Adaptive Inspection for Fraud in I4.0 Supply Chain (2021)
Schrödinger's security: opening the box on app developers' security rationale (2020)
OASIS: Weakening User Obligations for Security-critical Systems (2020)
Finding & Reviewing Community Policing Apps in Asia (2020)
How are you feeling? Using Tangibles to Log the Emotions of Older Adults (2020)
Designing Technologies for Community Policing (2020)
Towards Citizen Forensics: Improving Citizen-Police Collaboration (2020)
An Anatomy of Security Conversations in Stack Overflow (2019)
Talking about Security with Professional Developers (2019)
Hopefully We Are Mostly Secure: Views on Secure Code in Professional Practice (2019)
Dragonfly: a Tool for Simulating Self-Adaptive Drone Behaviours (2019)
Won’t Take No for an Answer: Resource-driven Requirements Adaptation (2019)
Modelling and Analysing Resilient Cyber-Physical Systems (2019)
Cautious Adaptation of Defiant Components (2019)
A Sensor Platform for Non-invasive Remote Monitoring of Older Adults in Real Time (2019)
Requirements and Specifications for Adaptive Security: Concepts and Analysis (2018)
Compositional Verification of Self-Adaptive Cyber-Physical Systems (2018)
Towards forensic-ready software systems (2018)
I’ve Seen This Before: Sharing Cyber-Physical Incident Knowledge (2018)
Using Argumentation to Explain Ambiguity in Requirements Elicitation Interviews (2017)
On Evidence Preservation Requirements for Forensic-Ready Systems (2017)
Crossing Boundaries: On the Inevitable Intertwining of Digital, Physical, and Social Spaces (2017)
Software Engineering Challenges for Investigating Cyber-Physical Incidents (2017)
Enabling End-Users to Protect Their Privacy (2017)
Live Blackboxes: Requirements for Tracking and Verifying Aircraft in Motion (2017)
Learning to Share: Engineering Adaptive Decision-Support for Online Social Networks (2017)
O2O Service Composition with Social Collaboration (2017)
Use of organisational topologies for forensic investigations (2017)
Are You Ready? Towards the Engineering of Forensic-Ready Systems (2017)
Examining Active Error in Software Development (2016)
Privacy-by-Design Framework for Assessing Internet of Things Applications and Platforms (2016)
CrowdService: Serving the Individuals through Mobile Crowdsourcing and Service Composition (2016)
Wearables for Physical Privacy (2016)
Privacy Dynamics: Learning Privacy Norms for Social Software (2016)
Adding static and dynamic semantics to building information models (2016)
Towards Adaptive Compliance (2016)
Privacy Itch and Scratch: On Body Privacy Warnings and Controls (2016)
Feed me, Feed me: An Exemplar for Engineering Adaptive Software (2016)
Managing security control assumptions using causal traceability (2015)
The Role of Environmental Assumptions in Failures of DNA Nanosystems (2015)
Towards explaining rebuttals in security arguments (2014)
Personal Informatics for Non-Geeks: Lessons Learned from Ordinary People (2014)
Self-adaptation through incremental generative model transformations at runtime (2014)
Traceability for adaptive information security in the cloud (2014)
Distilling Privacy Requirements for Mobile Applications (2014)
Requirements-driven mediation for collaborative security (2014)
Engineering topology aware adaptive security: preventing requirements violations at runtime (2014)
Topology aware adaptive security (2014)
From model-driven software development processes to problem diagnoses at runtime (2014)
Requirements-driven adaptive digital forensics (2013)
Engineering adaptive privacy: on the role of privacy awareness requirements (2013)
SecuriTAS: a tool for engineering adaptive security (2012)
An aspect-oriented approach to relating security requirements and access control (2012)
Getting at ephemeral flaws (2012)
Social adaptation: when software gives users a voice (2012)
Privacy arguments: analysing selective disclosure requirements for mobile applications (2012)
Requirements-driven adaptive security: protecting variable assets at runtime (2012)
Speculative requirements: automatic detection of uncertainty in natural language requirements (2012)
Caprice: a tool for engineering adaptive privacy (2012)
Adaptive security and privacy in smart grids: A software engineering vision (2012)
Specifying and detecting meaningful changes in programs (2011)
Towards learning to detect meaningful changes in software (2011)
Social sensing: when users become monitors (2011)
OpenArgue: supporting argumentation to evolve secure software systems (2011)
Risk and argument: a risk-based argumentation method for practical security (2011)
PrimAndroid: privacy policy modelling and analysis for Android applications (2011)
Learning to adapt requirements specifications of evolving systems (NIER Track) (2011)
In the best families: tracking and relationships (2011)
Model-Based argument analysis for evolving security requirements (2010)
Contravision: Exploring users' reactions to futuristic technology (2010)
ContraVision: presenting contrasting visions of future technology (2010)
Extending Nocuous Ambiguity Analysis for Anaphora in Natural Language Requirements (2010)
Automatic detection of nocuous coordination ambiguities in natural language requirements (2010)
A methodology for automatic identification of nocuous ambiguity (2010)
Requirements-driven collaborative choreography customization (2009)
On presuppositions in requirements (2009)
Making tacit requirements explicit (2009)
Are your lights off? Using problem frames to diagnose system failures (2009)
Studying location privacy in mobile applications: 'predator vs. prey' probes (2009)
Feature interaction as a context sharing problem (2009)
From spaces to places: Emerging contexts in mobile privacy (2009)
Towards safer composition (2009)
A multi-pronged empirical approach to mobile privacy investigation (2009)
From organizational requirements to service choreography (2009)
A framework for developing feature-rich software systems (2009)
Early identification of problem interactions: A tool-supported approach (2009)
Customizing choreography: Deriving conversations from organizational dependencies (2008)
Bridging requirements and architecture for systems of systems (2008)
Specifying Monitoring and Switching Problems in Context (2007)
Composing features by managing inconsistent requirements (2007)
Using problem descriptions to represent variabilities for context-aware applications (2007)
On the structure of problem variability: From feature diagrams to problem frames (2007)
Identifying nocuous ambiguities in natural language requirements (2006)
A framework for security requirements engineering (2006)
Patterns for service-oriented information exchange requirements (2006)
On Modelling access policies: relating roles to their organisational Context (2005)
Arguing security: validating security requirements using structured argumentation (2005)
Architecture-driven problem decomposition (2004)
The conundrum of categorising requirements: managing requirements for learning on the move (2004)
The Effect of trust assumptions on the elaboration of security requirements (2004)
Composing requirements using problem frames (2004)
Using Problem Frames and projections to analyze requirements for distributed systems (2004)
Picking battles: The impact of trust assumptions on the elaboration of security requirements (2004)
Deriving security requirements from crosscutting threat descriptions (2004)
Introducing abuse frames to analyse security requirements (2003)
Relating software requirements and architectures using problem frames (2002)
An abductive approach for analysing event-based requirements specifications (2002)
Security Requirements Engineering: when anti-requirements hit the fan (2002)
Report
Enriching Traceability with Context for Adaptive Information Security in the Cloud (2014)
Learning from Context: A Field Study of Privacy Awareness System for Mobile Devices (2011)
An Evaluation of the ReleasePlanner on the Treatment of Security and Evolving Requirements (2010)
Predators and Prey: Ubiquitous Tracking, Privacy and the Social Contract (2010)
Are Your Lights Off? Using Problem Frames to Diagnose System Failures (2009)
Depiction of Additional Node-related Elements in Graph-based Software Visualisations (2008)
Tool support to derive specifications for conflict-free composition (2008)
Introducing new features to a critical software system (2008)
Recovering Problem Structures from Execution Traces (2008)
Recovering Problem Structures to Support the Evolution of Software Systems (2008)
Analysing Monitoring and Switching Requirements using Constraint Satisfiability (2008)
Composing Problems: Deriving specifications from inconsistent requirements (2005)
Validating Security Requirements Using Structured Toulmin-Style Argumentation (2005)
Nocuous Ambiguities in Requirements Specifications (2005)
Core Security Requirements Artefacts (2004)
Managing Requirements for Mobile Learning (2004)
An Example Using Problem Frames: Analysis of a Lighting Control System (2003)
Picking Battles: the Impact of Trust Assumptions on the Elaboration of Security Requirements (2003)
Deriving Security Requirements from Crosscutting Threat Descriptions (2003)
Architecture-driven Problem Decomposition (2003)
Analysing Security Threats and Vulnerabilities Using Abuse Frames (2003)
Relating Software Requirements and Architectures Using Problem Frames (2002)